Various electronic control units (ECUs), for example in-vehicle ECUs mounted on vehicles, are known. Each ECU comprises a microcomputer and the like. The electrical output of the microcomputer sometimes become contrary to intention by noise, leakage, malfunction, or the like.
In U.S. Pat. No. 5,521,535 (JP-A-7-114869), when a trigger signal is inputted, a hold circuit (self hold circuit) changes its output level to a predetermined level. After the trigger signal disappears, the hold circuit keeps holding the predetermined output level. Where a control signal is outputted as a trigger signal from a microcomputer to the hold circuit, the state of output from the hold circuit remains unchanged even when the microcomputer itself is reset. Therefore, even when the microcomputer returns to the normal state, the state in which the output of the hold circuit should be cannot be determined.
For instance, a power supply ECU controls the state of the passage of current through feeder lines from a battery mounted on a vehicle to various parts of in-vehicle devices. It is assumed that the power supply ECU has a hold circuit and that power supply control signals are outputted to an accessory (ACC) relay and an ignition (IG) relay through the hold circuit. In this case, the microcomputer in the power supply ECU recovers from reset (released from reset) and turns off output without limitation. Even though the vehicle is running, there is a possibility that power supply to a power train system including an engine is suddenly stopped and it becomes uncontrollable. When the microcomputer recovers from reset and maintains output without limitation, power supply is kept on even though the vehicle is parked. This causes battery rundown.
These problems are especially remarkable when a hold circuit is provided. When no hold circuit is provided, however, inappropriate control signals being outputted is problematic. This situation takes place when the output is turned on by noise, leakage, malfunction, or the like without human intervention. This situation arises not only when the microcomputer is reset but also when, for example, the microcomputer is in low-power consumption state, such as a sleep state.
Therefore, when such a hold circuit is applied to a device calling for high reliability and safety, such as in-vehicle device, a separate circuit must be provided for ensuring reliability and safety. This results in the increased scale of device.